Only allow WASM execution in results view

koesie10 · koesie10 · commit d3e64539d068 · 2023-02-28T15:22:23.000+01:00
diff --git a/extensions/ql-vscode/src/abstract-webview.ts b/extensions/ql-vscode/src/abstract-webview.ts
@@ -24,6 +24,7 @@ export type WebviewPanelConfig = {
   view: WebviewView;
   preserveFocus?: boolean;
   additionalOptions?: WebviewPanelOptions & WebviewOptions;
+  allowWasmEval?: boolean;
 };
 
 export abstract class AbstractWebview<
@@ -116,6 +117,7 @@ export abstract class AbstractWebview<
       config.view,
       {
         allowInlineStyles: true,
+        allowWasmEval: config.allowWasmEval ?? false,
       },
     );
     this.push(
diff --git a/extensions/ql-vscode/src/interface-utils.ts b/extensions/ql-vscode/src/interface-utils.ts
@@ -129,10 +129,13 @@ export function getHtmlForWebview(
   view: WebviewView,
   {
     allowInlineStyles,
+    allowWasmEval,
   }: {
     allowInlineStyles?: boolean;
+    allowWasmEval?: boolean;
   } = {
     allowInlineStyles: false,
+    allowWasmEval: false,
   },
 ): string {
   const scriptUriOnDisk = Uri.file(ctx.asAbsolutePath("out/webview.js"));
@@ -172,7 +175,9 @@ export function getHtmlForWebview(
 <html>
   <head>
     <meta http-equiv="Content-Security-Policy"
-          content="default-src 'none'; script-src 'nonce-${nonce}' 'wasm-unsafe-eval'; font-src ${fontSrc}; style-src ${styleSrc}; connect-src ${
+          content="default-src 'none'; script-src 'nonce-${nonce}'${
+    allowWasmEval ? " 'wasm-unsafe-eval'" : ""
+  }; font-src ${fontSrc}; style-src ${styleSrc}; connect-src ${
     webview.cspSource
   };">
         ${stylesheetsHtmlLines.join(`    ${EOL}`)}
diff --git a/extensions/ql-vscode/src/interface.ts b/extensions/ql-vscode/src/interface.ts
@@ -221,6 +221,8 @@ export class ResultsView extends AbstractWebview<
       viewColumn: this.chooseColumnForWebview(),
       preserveFocus: true,
       view: "results",
+      // Required for the graph viewer which is using d3-graphviz WASM module
+      allowWasmEval: true,
     };
   }
 

Original file line number	Diff line number	Diff line change
`@@ -221,6 +221,8 @@ export class ResultsView extends AbstractWebview<`
`221`	`221`	`viewColumn: this.chooseColumnForWebview(),`
`222`	`222`	`preserveFocus: true,`
`223`	`223`	`view: "results",`
	`224`	`+ // Required for the graph viewer which is using d3-graphviz WASM module`
	`225`	`+ allowWasmEval: true,`
`224`	`226`	`};`
`225`	`227`	`}`
`226`	`228`